You get a text message from a number you don’t recognize asking a pretty normal question: “Is this still available for purchase?” Attached to the text is an image that appears to show a Facebook Marketplace listing. Maybe you’re confused because you don’t remember selling anything. Then you look at the seller’s name. It’s yours. That small detail could be enough to make you respond with something like, “That’s not me.” And that reaction may be exactly what the person behind the message wants.
Security researchers at Malwarebytes are warning about a personalized text scam that uses fabricated Facebook Marketplace listings with the recipient’s name as the seller. The message can create an immediate fear that someone is impersonating you online. Here’s how this scam pulls you in and what you should do if one of these texts lands on your phone.
Join us for a free CyberGuy LIVE class.
Kurt “CyberGuy” Knutsson shares practical ways to stay safer, smarter and more confident with technology. Explore classes on stopping spam, phone security, financial protection and using AI to get better healthcare. Each class is free, easy to follow and comes with a free printable checklist.
See the classes and register at CyberGuyLive.com.
THE SECRET LIST THAT TELLS SCAMMERS YOU’RE AN EASY TARGET
Malwarebytes analyzed an example sent through iMessage. The text asked whether an item was still available and included an image resembling a Facebook Marketplace listing. The clever part appears when you look at the supposed seller. The recipient’s real name is there.
However, Malwarebytes noticed something strange. The profile photo did not belong to the recipient. Researchers traced the picture to another Facebook user who happened to have the same name.
That suggests the scammer may have started with a name and matching phone number. Those details could potentially come from breached data or another source. The attacker could then use the name to build a convincing fake Marketplace screenshot. Seeing your name creates an obvious question: “Is someone pretending to be me?” Before you know it, you’re typing a reply.
This technique is known as a conversation lure. Instead of immediately asking for a password or sending an obvious phishing link, the sender gives you a reason to start talking. In this case, the lure feels personal. Someone apparently put your name on a Marketplace listing. You may want to correct the buyer or find out what happened. You might also worry that someone has created a fake Facebook account in your name.
The exact motive behind this particular campaign remains unclear because determining the next step would require engaging with the sender. Still, replying to suspicious texts carries its own risk. The Federal Trade Commission warns that even replying to an unexpected text can confirm that a scammer has reached a working telephone number. That could lead to more scam calls and texts.
Think about how harmless a response such as “wrong person” feels. You haven’t shared a password or sent money. You haven’t clicked a suspicious website. However, you’ve given the sender something useful: confirmation that someone is actively using the number and willing to respond. Malwarebytes reports that a live number can become more valuable to scammers and potentially be resold to others. The number could also be combined with additional information gathered from public profiles, breached databases or other sources. That can help set up another scam.
You might later receive a fake delivery alert. Another message could pretend to come from your bank. A scammer might eventually try to steal a verification code, direct you to a malicious site or build a longer conversation designed to gain your trust. We recently looked at what a scammer can do with your name, phone number and address. Those details can become far more useful when criminals combine them with other personal information.
Creating individual Marketplace screenshots for thousands of people once would have required a lot of tedious work. AI and automation can change that equation. Malwarebytes says an attacker with a list containing names and phone numbers could potentially use an AI agent to help create personalized lures at scale. However, researchers have not established that AI created the specific example they examined. Still, automation makes this kind of personalization much easier to produce.
That’s an important shift in how we should judge suspicious messages. A text knowing your name provides little reassurance that the sender actually knows you. Personal information gets exposed through breaches, scraped from public sources and traded in criminal marketplaces. Once scammers connect a few pieces, they can make a random message feel surprisingly personal.
No. Seeing your name on one of these fake Marketplace images does not, by itself, mean someone has accessed your Facebook account. The Marketplace screenshot may simply be fabricated. That’s why I would resist the urge to reply to the sender asking what’s going on. Instead, check Facebook yourself.
Apple says this type of deceptive messaging uses social engineering, a tactic in which scammers rely on impersonation and manipulation to persuade people to share personal information. Criminals may pretend to represent a trusted company or organization while trying to obtain passwords, security codes or financial details.
Apple also points to an important iMessage protection. By default, users cannot open links sent by an unknown iMessage sender until they add that person to their contacts or reply to the message. That gives you another reason to avoid responding to an unexpected text. Apple recommends treating suspicious, unexpected messages as potential scams and contacting the company directly through a trusted channel. The company also says users can filter unknown senders, report suspicious messages and block unwanted contacts through Messages.
Apple’s Messages app includes tools to help filter unwanted texts, report suspicious messages and block senders. Since this Facebook Marketplace scam arrives through iMessage, here’s how to use those protections on an iPhone.
Messages from unknown senders will appear in a separate folder instead of your main conversation list. Apple says you won’t receive notifications for these messages unless you’ve chosen to allow certain categories of unknown messages.
SCAMMERS KNOW THE BEST TIME TO TEXT YOU
Apple says reporting an iMessage sends the sender’s information and message content to Apple. The message is then permanently deleted from your iPhone. However, reporting does not automatically block the sender, so follow the blocking steps below. If you have already replied, the reporting option may no longer be available. For SMS, MMS or RCS messages that don’t display a reporting option, Apple recommends contacting your wireless carrier directly.
Blocking prevents messages from that number from reaching you. The sender won’t receive a notification that you’ve blocked them.
Important: These protections can reduce exposure to scam messages, but they cannot guarantee that every personalized phishing attempt will be detected. Don’t reply to a suspicious Marketplace message simply because it contains your real name.
A message like this is designed to make you react. Instead, give yourself a moment and investigate through channels you trust.
Even telling the sender they have the wrong person can confirm that somebody is actively using the number. The FTC recommends avoiding replies to unexpected messages from unknown numbers.
Don’t click a link, call a number or scan a QR code supplied in the conversation. Never send the person a one-time security code or a screenshot containing security information. If you need to check Facebook, open the app yourself or type the address directly into your browser.
Strong antivirus software can help protect you if a scammer eventually sends a malicious link or tries to get you to download malware. It can also warn you about some dangerous websites before they cause trouble. The best way to protect yourself from malicious links that install malware and potentially access your private information is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
WHY VERIFIED SOCIAL MEDIA ACCOUNTS CAN STILL LEAD YOU INTO A SCAM
Open Facebook and review your Marketplace activity and messages. Look for anything you didn’t post or send. You should also review your account security for unfamiliar logins, changed contact information or other activity you don’t recognize.
If a suspicious message appears to come from someone you actually know, contact that person through a different method. For example, call a number you already have saved rather than using contact information supplied in the suspicious message.
On an iPhone, follow the reporting and blocking steps above. Android users can use their messaging app’s built-in spam reporting and blocking features. The FTC also recommends forwarding unwanted texts to 7726 (SPAM). These reports can help wireless providers identify and block similar messages.
If you discover that someone really has created a Facebook profile pretending to be you, preserve the profile’s URL and report it to Facebook. A fake screenshot alone does not prove that an impersonating Facebook profile actually exists. Check Facebook independently before assuming someone has created one.
If you discover an unfamiliar login, changed account information or other evidence of unauthorized access, start Facebook’s account recovery process immediately. You should also review your password and enable two-factor authentication (2FA). Facebook currently places its two-factor authentication controls under Accounts Center > Password and security > Two-factor authentication.
This scam shows why exposed personal information can be so useful to criminals. Your name and phone number may already appear on people-search sites or in data-broker databases. Removing that information won’t erase data already exposed in a breach, but it can reduce what scammers can easily find and use to personalize future attacks. While no service can promise to remove all your data from the internet, a data removal service can monitor and automate the process of removing your information from hundreds of sites continuously over a longer period. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
Don’t assume a single response means your phone or Facebook account has been compromised. A reply alone does not give someone access to your Facebook account. What you should do next depends on how far the interaction went.
What makes this scam so convincing is the personal detail. You see your own name on a Marketplace listing you never created, and, of course, you want to know what’s going on. That’s exactly why you should avoid replying to the stranger who sent it.
Instead, open Facebook yourself and check your account. If you don’t see the listing or any suspicious activity, report the text, block the sender and move on. If something looks wrong, secure your Facebook account right away.
The bigger concern here is how easily scammers can use pieces of our personal information to make a random text feel legitimate. Your name and phone number may already be available through a data breach, data broker or another source. Seeing accurate information about yourself in an unexpected message should make you more cautious, not more trusting.
Scammers keep finding new ways to use our personal information against us, so who should bear more responsibility for stopping these attacks before they reach our phones? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Copyright 2026 CyberGuy.com. All rights reserved.
